Socket

Socket is the company and the routing technology; Bungee is its consumer app at bungee.exchange. The terms of use, last updated 2 March 2026, name the operator as Socket Technologies Limited, a British Virgin Islands company, and cover the Bungee website, the Bungee API and SDK, and the underlying smart contracts in one agreement. The developer documentation now sits at docs.socket.tech, and the old docs.bungee.exchange address redirects there.

The docs describe Socket as a routing engine for moving money across chains, stablecoins and payment methods. Third-party apps embed it through an API or a ready-made widget; Bungee is the company's own front end on top of the same engine. On its business partnership page Socket names two co-founders, Vaibhav Chellani and Rishabh Khurana, and asks partners to deal only with them. Its GitHub organisation, SocketDotTech, was created in June 2021.

Socket does not publish funding rounds, staff numbers or a corporate address beyond the BVI registered office. Its documentation describes no token for the routing service.

Socket is an aggregator, not a bridge with its own validators. When a user asks to move USDC from Base to Arbitrum, for example, the API asks the bridges and DEX aggregators it supports for quotes, then returns routes tagged as suggested, fastest, maximum output or minimum input. The docs say off-chain agents (fillers, solvers and provers) compete to execute the chosen route and deliver the output token to the receiving address.

The user approves a Socket contract to spend the input token and signs on the source chain. On EVM networks the current contracts are an Allowance Holder and an Open Router deployed at the same addresses on each chain, which are listed in the docs. The security of the transfer then depends on the bridge that carries it, whether that is Circle's CCTP, Across, a native rollup bridge or the Celer cBridge.

• Refuel: adds a small amount of destination-chain gas to a transfer.
• Deposit addresses: send funds to a generated address instead of signing a contract call.
• Incognito mode: routes only through Houdini or ChangeNOW so the sending and receiving wallets are not directly linked on-chain.
• Stocks: tokenized stock exposure through a separate API, shown in Bungee as a Stocks section.

As of October 2026 the Bungee site also advertises leveraged perpetuals and a funded-trader challenge alongside swaps. Socket's docs do not explain which venue executes those trades or who carries the risk, so treat them as separate products and read their terms before using them.

Socket's fee page says it adds no markup to transactions and charges integrators nothing for API use; quoted amounts already include on-chain execution costs. What a user pays is the network gas, the fee of the bridge or DEX on the winning route, and slippage. Apps that embed the Socket API can add their own fee through a fee parameter, so the same route can cost more inside a wallet than on Bungee itself.

The terms keep the right to introduce fees and say any Socket fee will be shown before a transaction is submitted. Fees for Bungee's perpetuals and stock products are not listed in the docs we read.

The terms bar people in a long list of restricted jurisdictions, including Cuba, Iran, North Korea, Russia, Syria, Venezuela, mainland China, Ukraine and Belarus, and forbid using a VPN to get around geographic blocks. They also say Socket does not represent that the service is available in all jurisdictions, "including the United States", and may restrict access. Users must be at least 18.

There is no account or identity check for swaps: you connect a wallet and sign. Disputes go to individual arbitration under ICDR rules with a class-action waiver, under British Virgin Islands law, unless you send an opt-out to [email protected] within 30 days of first accepting the terms.

Socket is non-custodial: the terms state it never holds user assets or keys. The risk sits in two places, the routing contracts you approve and the bridge that carries the transfer. An aggregator adds its own contract layer on top of the bridge's trust model; it does not remove any.

That layer failed on 16 January 2024. According to Rekt, a route added to the SocketGateway contract three days earlier did not check a swap parameter, which let an attacker call transferFrom on wallets that had given the gateway unlimited approval. About $3.3 million in ETH, WETH, WBTC, MATIC and DAI was taken on Ethereum. Rekt reports the team disabled the route roughly 14 minutes after the attack began and that neither existing audit covered the new code.

Socket publishes its audit reports on GitHub. The Bungee folder holds reviews by PeckShield (registry, 2021), Consensys Diligence (gateway, 2023), Decurity (route implementations, 2024–2025) and Hexens (Bungee protocol, December 2024); a separate folder covers Socket's data layer, Super Bridge and Super Token work by Zellic and Hexens, plus a PeckShield review of Open Router. An audit covers the code as reviewed on that date. We did not find a public bug bounty or insurance fund.

Read these before moving a large amount.

• Approval risk: approve only the amount you are moving, and revoke router approvals afterwards. The 2024 losses came from standing unlimited approvals. Our guide to token approvals shows how to check them.
• Bridge risk: each route inherits the trust model of the underlying bridge, which can be a committee, an intent network or a rollup's own bridge.
• Integrator risk: a wallet using Socket's API can add fees or change which providers are shown.
• Product scope: perps, funded trading and tokenized stocks carry risks that a swap does not, and their terms are not in the swap documentation.
• Legal recourse: liability is capped at the greater of $100 or what you paid Socket in the previous 12 months.

In Bungee you connect a self-custodial wallet, pick the source and destination chains and tokens, compare routes, approve and sign. The app and API track status by quote ID until the destination funds arrive. If a route fails, the deposit flow requires a refund address and returns funds there, and bridge-level refunds follow the rules of the bridge that was used.

Since Socket never holds your assets, there is nothing to withdraw from Socket itself: tokens land in the receiving wallet. If a transfer appears stuck, the bridge's own explorer for the source transaction is usually the quickest check.

Socket runs a public status page at status.socket.tech. Legal notices go to [email protected], and GitHub lists [email protected] as a general address. Partnership requests go through a form in the docs, and the docs say business deals should only involve the two named co-founders, which helps against impersonators offering listings or integrations.

Never share a seed phrase with anyone claiming to be Bungee support; the terms say Socket will never ask for a private key.

Dated milestones from Socket's own records.

• June 2021: SocketDotTech GitHub organisation created.
• September 2021: PeckShield audits the registry contract.
• February 2023: Consensys Diligence audits the Socket gateway.
• July–August 2023: Zellic and Hexens audit the Socket data layer and Super Bridge.
• 16 January 2024: gateway route exploit, about $3.3 million lost.
• December 2024: Hexens audits the Bungee protocol.
• 2025–2026: the Bungee API is replaced by the Socket Swap V3 API and docs move to docs.socket.tech; the terms are updated on 2 March 2026.

For how Socket's routing compares with single bridges, see our bridge rating card for Socket and Bungee.